$smartScreenLog = 'Microsoft-Windows-SmartScreen/Operational'
try {
# Test if the SmartScreen log path exists
Get-WinEvent -LogName $smartScreenLog -MaxEvents 1 -ErrorAction Stop | Out-Null
} catch {
# If not, use the alternative path
$smartScreenLog = 'Microsoft-Windows-SmartScreen/Debug'
Write-Warning "The log path '$smartScreenLog' was not found. Using the alternative '$smartScreenLog'."
}
Get-WinEvent -FilterHashtable @{
LogName = 'Microsoft-Windows-AppLocker/EXE and DLL', $smartScreenLog
Level = 2
StartTime = (Get-Date).AddHours(-12)
} | Select-Object TimeCreated, LogName, LevelDisplayName, Message